After playing around a bit with
openssl, I created a PKCS12 certificate which imports flawlessly in Firefox while Thunderbird "Could not verify this certificate for unknown reasons". Talk about a helpful error message here. While I managed to solve the problem (the certificate had an
emailProtection,clientAuth while the signing CA had
emailProtection only - why did Firefox import it then?!) in this case, I'd like to know about a less trial-and-error way to figure out why a specific certificate fails.
I could find a large number of threads and bug reports, e.g. this, which suggest whatever library is internally used does actually provide more meaningful error messages, but I don't have an idea where to start calling it or whether some simple command line tools exist to achieve this. So in summary:
How to figure out why a Mozilla product rejects importing a certificate "for unknown reasons"